oss-sec mailing list archives
Re: non-Linux advance notification list
From: Solar Designer <solar () openwall com>
Date: Sat, 28 Jan 2012 05:18:57 +0400
Hi, I would definitely like OpenBSD to be represented on the distros list. Not only OpenBSD ports, but also OpenBSD base. On Sat, Jan 28, 2012 at 12:39:19AM +0000, Stuart Henderson wrote:
Could you add myself for OpenBSD ports please? If acceptable I'll send a public key out of band. Thanks.
Probably yes, but I (and maybe others) would like some info first: Is there any web page (or something else) specifying the OpenBSD ports security team (not all committers, but just those the project vouches for as it relates to handling of non-public security vulnerabilities)? Or a port-security@ exploder that you're on. Or explicit approval (vouching for you) by a key OpenBSD person for this specific occasion. (For NetBSD and FreeBSD, the folks subscribed were "visibly" on security teams.) Is there any place where we can see past security issues in OpenBSD ports handled (which issues, when fixed)? Something like a changelog with security fixes marked specially, or advisories? Would advance notifications result in you actually preparing OpenBSD port updates in time for public disclosure? How would you handle notifications that happen to pertain to components that are in OpenBSD base tree rather than ports? BTW, note how my current approach differs from what was used on vendor-sec: I ask projects themselves (known and reputable) to vouch for folks to be added on their behalf, whereas on vendor-sec some existing list members would vouch for a new member. I'd appreciate any comments anyone might have on this. Thanks, Alexander
Current thread:
- Re: non-Linux advance notification list Solar Designer (Jan 27)
- <Possible follow-ups>
- Re: non-Linux advance notification list Solar Designer (Jan 27)
- Re: non-Linux advance notification list Stuart Henderson (Jan 27)
- Re: non-Linux advance notification list Solar Designer (Jan 27)
- Re: non-Linux advance notification list Stuart Henderson (Jan 27)